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Abstract — Failure restoration at the IP layer in IP-over- WDM 
networks requires to map the IP topology on the WDM topology 
in such a way that a failure at the WDM layer leaves the IP 
topology connected. Such a mapping is called survivable. As 
finding a survivable mapping is known to be NP-complete, in 
practice it requires a heuristic approach. We have introduced 
in [1] a novel algorithm called "SMART", that is more effective 
and scalable than the heuristics known to date. Moreover, the 
formal analysis of SMART [2] has led to new applications: the 
formal verification of the existence of a survivable mapping, and a 
tool tracing and repairing the vulnerable areas of the network. In 
this paper we extend the theoretical analysis in [2] by considering 
multiple failures. 

I. Introduction 

Generally, there are two approaches for providing surviv- 
ability of IP-over-WDM networks: protection and restora- 
tion [3]. Protection uses pre-computed backup paths applied in 
the case of a failure. Restoration finds dynamically a new path, 
once a failure has occurred. Protection is less resource efficient 
(the resources are committed without prior knowledge of the 
next failure) but fast, whereas restoration is more resource 
efficient and slower. Protection and restoration mechanisms 
can be provided at different layers. IP layer (or logical layer) 
survivability mechanisms can handle failures that occur at both 
layers, conttary to WDM layer (or physical layer) mechanisms 
that are transparent to the IP topology. It is not obvious 
which combination (mechanism/layer) is the best; each has 
pros and cons [4]. IP restoration, however, deployed in some 
real networks, was shown to be an effective and cost-efficient 
approach (see e.g., Sprint network [5]). In this paper we will 
consider exclusively the IP restoration approach. 

Each logical (IP) link is mapped on the physical (WDM) 
topology as a lightpath. Usually a fiber is used by more than 
one lightpath (in Sprint the maximum number is 25 [6]). 
Therefore, even a single physical link failure usually brings 
down a number of IP links. With the IP restoration mechanism, 
these IP link failures are detected by IP routers, and alternative 
routes in the IP topology are found. In order to enable this, 
the IP topology should remain connected after failures; this 
in turn may be guaranteed by an appropriate mapping of IP 
links on the physical topology. Such a mapping is called a 
survivable mapping. 

For a given pair of physical an logical topologies, finding a 
survivable mapping is an NP-complete problem [7]. Therefore 
the exact approaches, such as Integer Linear Programming [7], 



[8], do not scale well. For this reason various heuristics 
were proposed, e.g., Tabu Search [8], [9], [10], Simulated 
Annealing [4] and others [3], [11]. In [1] we have proposed 
a novel approach that led us to a heuristic algorithm called 
"SMART", that is much more effective and scalable than the 
heuristics known to date. 

The SMART algorithm, however, is not only a heuristic. 
The theoretical studies in [2] have revealed a number of useful 
properties of our algorithm. This was made possible by the 
introduction of a new type of mapping that preserves the sur- 
vivability of some subgraphs ('pieces') of the logical topology; 
we call it a piecewise survivable mapping. The formal analysis 
of the piecewise survivable mapping shows that a survivable 
mapping of the logical topology on the physical topology 
exists if and only if there exists a survivable mapping for a 
contracted logical topology, that is, a logical topology where a 
specified subset of edges is contracted (contraction of an edge 
amounts to removing it and merging its end-nodes). This result 
substantially simplifies the verification of the existence of a 
survivable mapping, making it, for the first time, often possible 
for moderate and large topologies. A second application of a 
piecewise survivable mapping is tracing the vulnerable areas 
in the network and pointing where new link(s) should be added 
to enable a survivable mapping [2]. 

This paper extends the theoretical results in [2] by consid- 
ering multiple failures, i.e., independent failures of a number 
of physical links. Usually such a situation takes place when a 
failure occurs before another one is repaired. This is possible 
in practice. For example, in the Sprint network, the time 
between two successive optical failures ranges from 5.5 sec 
to 7.5 days with a mean of 12 hours [6]. Most of them 
are repaired automatically within several minutes, but those 
requiring human intervention (e.g., after a fiber cut) may last 
hours or days. It is quite probable that during that period 
another physical failures occur. 

We have already discussed the multiple failures, or more 
specifically double-link physical failures, in [1]. However, the 
preliminary results described in [1] were not supported by 
any theoretical analysis, which limited our approach to an 
efficient heuristic only. Here we close this gap by studying 
a new, more general definition of survivability: If the logical 
topology remains connected after a failure of any k physical 
links, then the underlying mapping is called "fc-survivable." 
Consequently, a version of the SMART algorithm that finds a 



fc-survivable mapping will be henceforth called fc-SMART. 

It is worth noting that double-link physical failures were 
also considered in [12], [13], [14]. But these approaches use 
WDM layer protection and restoration mechanisms, whereas 
we focus on a failure recovery at the IP layer. 

The organization of this paper is the following. Section [H] 
introduces the notation and formalizes the problem. SectionlTTTl 
gives three fundamental theorems. Section IIVI introduces 
the fc-SMART algorithm and discusses its properties. Sec- 
tion [V] describes a possible implementation and applications 
of fc-SMART. Finally, Section IV1I concludes the paper. 

II. Notation and problem formulation 

For self-containedness, we give in this section the notation 
introduced in [2]. When necessary, we extend it to multiple 
failures. 

A. Generalities 

We use the formal notation of graph theory, mainly based on 
[15]. However, we also introduce the stack of our definitions 
well suited to the problems we tackle. The following general 
notation is used: 

• 4> corresponds to the physical topology, 

• L corresponds to the logical topology, 

• C corresponds to the contracted topology (introduced 
later in Section Hl-CL 

• a, b, c, d, e . . . are used to denote edges/links, 1 

• u,v,w ... are used to denote vertices/nodes, 2 

• p is used to denote a path, i.e., a sequence of edges, 
where two consecutive edges have a common end-node. 
We say that a node u is in a path p, u E p, if u is an 
end-node of at least one edge in p. A path p from vertex 
v to vertex u will be denoted by p v , u . 

Physical and logical topologies are represented by undi- 
rected simple graphs: G"* = {V,E' t >) and G L = (V,E L ), 
respectively. V is the set of vertices, E^ and E L are the sets 
of undirected edges. In reality, not every physical node (i.e., 
optical switch) has an IP routing capability, which would imply 
V* DV L . All the the results in this paper hold for V^ D V L , 
but for the sake of simplicity we have chosen to keep V^ and 
V L identical (V* = V L = V). 

B. Lightpath and mapping 

Definition 1 (Lightpath): A logical link e L is mapped on a 
physical topology as a physical path p^ in such a way that p^ 
connects the same two vertices in G^ as e L connects in G L . 

In optical networking terminology, such a physical path p^ 
is called a lightpath. The failure of any physical link in p^ 
breaks the lightpath and consequently brings down the logical 
link e L . Note that, since we release the capacity constraints, we 
do not have to consider the wavelengths assigned to lightpaths 
and wavelength converters placement. 

'The terms edge and link will be used interchangeably 
2 The terms vertex and node will be used interchangeably 



Definition 2 (Mapping): Let P^ be a set of all possible 
physical paths in the physical topology and A C E L be 
a set of logical links. A mapping Ma is a function Ma '■ 
A — ► P^ associating each logical link from the set A with a 
corresponding lightpath in the physical topology. 

For some particular logical edge e L E A, Ma returns a 
physical pathp^ = Ma(c l ), p^ E P^ ■ For arguments beyond 
A, Ma is not defined. We also allow putting a set of logical 
links A su t, C A as an argument, which results in a set of 
lightpaths Mi(Aai) C P^. Similarly, taking as an argument 
a logical path p L whose edges are in A, we obtain a set of 
lightpaths Ma(p l ) C P* associated with the edges of p L . 

Example 1: Fig. [l] illustrates the definitions given above. In 
Fig-& the mapping Ma is defined for the subset A of logical 
links (marked in bold in the logical topology). For example, we 
have M A (f L ) = {d^ , b* , g*} , which means that the lightpath 
assigned for the logical edge f L consists of three physical 
links. Fig. \\]p presents a mapping defined for the subset B, 
whereas the mapping M e l in Fig. ^ is defined for all links 
of the logical topology E L = Al) B. 

We will often deal with mappings of different subsets of 
logical edges. Let A\,A 2 C E L . For consistency, we always 
require that: 

for every e L E A x n A 2 : M Al (e L ) = M A2 {e L ). (1) 

The mappings Ma x and Ma 2 can t> e merged, resulting in a 
mapping Ma 3 defined as follows 

A 3 = A ± UA 2 (2) 

MaMs) = M Al {A 1 )\JM Aa {A 2 ). (3) 

For convenience of notation, we will write (|2j and Q as 
M As =M Ai UMa 2 . 

C. Contraction and Origin 

In the paper we will often use the graph operator of 
contraction, which is illustrated in Fig. |2] and is defined as 
follows: 

Definition 3 (Contraction [15]): Contracting an edge e E 
E of a graph G = (V,E) consists in deleting that edge and 
merging its end-nodes into a single node. The result is called 
the contraction of a graph G on an edge e (or simply a 
contracted graph), and is denoted by G c = G [e. 

By extension, we also allow contracting a set of edges A C 
E, resulting in a contracted graph G c — G [A, obtained by 
successively contracting the graph G on every edge of A. It is 
easy to show that the order in which the edges of A are taken 
to contraction, does not affect the final result. 

LetG=(V,E), AcE and G c = (V c , E c ) = G{ A. 
Note that by construction E c = E\A. Therefore each edge 
of G c can be found in G, as depicted in Fig. |2] This is 
not always true for vertices. A vertex of V c may either 
'originate' from a single vertex in G (like w c in Fig. |2ji, or 
from a connected subgraph of G (like v c and u c ). We call 
this relation an Origin(-). 




(a) Mapping of the set 

A = {a L ,b L ,c L ,f L ,g L ,h L } 



(b) Mapping of the set 
B = {d L ,e L } 



(c) Full mapping 

E L 



A\JB = {a L , b L , c L , d L ,e L ,f L ,g L ,h L } 



Fig. 1. Three mapping examples. We have four layers, from bottom to top: the physical topology G&, the mapping M, the logical topology G L and 
the contracted logical topology G c (only in (a)). In (a) the pairs \G^ L L L ,Mji] and \G^, L L j^^M^l are 1-survivable, and therefore the pair 

^G L ,Ma] is piecewise 1-survivable. In (b) the mapping Mb maps edge-disjointly the set B = {d L , e L } of two logical links. The contracted topology G 
in (a) is composed of these two links. Taking G c and Mg together, we obtain the pair \G C ' , Mg\ , which is 1-survivable. In (c) the pair \G L , M e l] is 
1-survivable, that is M e l is a 1-survivable mapping of the entire logical topology. 




G c = G[A 



w d x 
A = {a,b,c : g} 



Contraction 




Origin(e) 
Origin(v ) 
Origin(u ) 



Origin(w ) 
Origin(^({u C , w C } , {/, h})j 



— {{u, v, kj}, {a, 6, c}) 

= ({v,*},g) 

— X 

= ({x,y,z},{f,g,h}) 



Fig. 2. Contraction of a graph G on a set of edges A = {a, b, c,g}. The 
origins of some elements of G c = G J. A are also shown (bottom). 



Definition 4 (Origin): Let G c = G J. A. Now take a 
subgraph Gg b C G c . We say that G sub = Origin(G^ ub ), 
if G su b is the maximal subgraph of G that was transformed 
into G^ lb by the contraction of A in G. 

According to this definition, the result of the Origin(-) 
function is the maximal subgraph transformed in its argument. 



For example, one could say that in Fig. [2] the vertex z 6 G 
was transformed into the vertex u c 6 G c , however z ^ 
Origin(u c ) because it is not the only element that was 
transformed into u c by contraction. The maximal subgraph 
in this case is ({y, z},g) — Originiu ,). 

D. k-survivability and piecewise k-survivability 

Let M e l be a mapping of the logical topology G L on the 
physical topology G^ . Assume that a physical link e^ fails. 
Each logical link in G using e^ in its mapping (lightpath) 
will than be cut. This may cause a disconnection of G L . If, 
after any single physical lifik failure, the graph G L remains 
connected, then the pair \G L ,M e l~\ is declared 1-survivable. 
We extend this property to multiple failures and to a family of 
graphs constructed from the logical topology in the following 
definition: 

Definition 5 (k-survivability): Let G L — (V,E L ), A C 
E L and G c = (V C ,E C ) = G L | A. Take any connected 
subgraph G s ^ b = (Xub^) °f ^ e contracted topology G c , 
and let Mb be a mapping of the set B of logical links. The 
pair [G^ b , Mb] is k-survivable if any simultaneous failure of 
k physical links does not disconnect the graph G^ b . 



(Clearly, when we speak of a fc-survivable pair, we implicitly 
assume the existence of a particular physical and a logical 
topology.) 

A direct consequence of Definition [5] is that if [G^Mb] 
is fc-survivable, then [G s „ 6 , Mb'] is also fc-survivable, for any 
B C B' CE L . 

In Definition [5] G^ b represents a large family of graphs 
obtained from the logical topology. If A = 0, then G c = G L 
and G^ b is any connected subgraph of G L (including G L 
itself). If A ^ 0, then G^ b is any connected subgraph of 
G L [ A. The different instances of G^ b and survivable pairs are 
given in Fig.JQand described in the following three examples: 

Example 2: One can check that in Fig. [Q: the pair 
[G l ,M e l] is 1-survivable. 

Example 3: In Fig. [^, let Gf aL bL qL -. be the subgraph of 
G L defined by the edges a L ,b L ,c L and their end- vertices. 
The pair [Gf aL bL cL -,, Ma] is 1-survivable, because a failure 
of any single physical link does not disconnect Gf aL bL cL \. 
Similarly, the pair [Gf fL L IiL ~, 7 Ma] is also 1-survivable. 

Example 4: In Fig. [TJ, the contracted topology G c is the 
result of the contraction of the logical topology on the set 
A, i.e., G c = G L [A. Take G^ b = G c . It consists of two 
logical links, d L and e L . A possible mapping of the set B = 
{d L ,e L } is the mapping Mb shown in Fig [Q). Consider the 
pair [G c ,Mb\\ it is 1-survivable, because a single physical 
link failure cannot bring down both d L and e L at the same 
time, hence G remains connected. 

Definition 6 (Piecewise k-survivability): Let Ma be a 
mapping of a set A C E L on the physical topology. The 
pair \G L , Ma] is piecewise k-survivable if, for every vertex 
v c of the contracted logical topology G L [ A, the pair 
\Origin{v c ) 1 MA] is fc-survivable. 

Unlike fc-survivability, piecewise fc-survivability is de- 
fined only for the entire logical topology G L . We will say 
that a mapping Ma is (piecewise) fc-survivable, if the pair 
[G L ,Myi] is (piecewise) fc-survivable (i.e., we take G L as 
the default topology). 

Example 5: In Fig. ^, the pair [G^M^t] is piecewise 
1-survivable. To prove it, we have to show that for ver- 
tices u c and v c of G L \,A, the pairs [Origin(u c ), Ma] 
and \Origin(v c ),MA] are 1-survivable. Here we have 
Origin(u c ) = G^ aL bL cL , and Origin(v c ) = Gy LgLhL} . 
We have shown in Example [3] that each of these two graphs 
forms a 1-survivable pair with Ma- 

Definition |3 can be also restated as follows: 
Definition 7 (k-survivability new): Let G L = (V,E L ), 
A C E L and G c = (V c , E c ) = G L [A. Take any connected 
subgraph G^ b = {V^B), B C E c , of the contracted 
topology G c , and let Mb be a mapping of the set B of 
logical links. The pair [G s ^ b , Mb] is k-survivable if for any 
set E^ C E$ of fc physical links and for any two vertices 
u, v e \T^ b , there exists a path p„ v in G s ^ b between vertices 
u and v, such that M B {p% yV ) (~l e( = 0. 



(Note that every path in the contracted topology, e.g., p^ v , 
actually consists of logical links.) 

In other words, a mapping is fc-survivable if after a dele- 
tion of any set Ej, of fc physical links we can still find a 
path between every pair of vertices in G^ b . Clearly, this is 
equivalent to keeping G s ^ b connected (as in Definition |5J; the 
latter formulation is easier to be applied in the proofs in the 
reminder of this paper. 

III. Fundamental properties of fc-suRvivABLE and 

PIECEWISE fc-SURVIVABLE MAPPINGS 

In this section we prove three useful properties of 
fc-survivable and piecewise fc-survivable mappings. We will 
often use them in the following sections. 

A. The expansion of k-survivability 

Given a piecewise fc-survivable mapping, the logical topol- 
ogy can be viewed as a set of fc-survivable 'pieces'. This 
is a general property of a piecewise fc-survivable mapping. 
(For instance in Example [5] given the piecewise 1-survivable 
mapping Ma, there are two 1-survivable 'pieces' of G L : 

G U^^} c ° L and G {>^^} c ° L -) The following 
theorem enables us to merge some of these pieces, resulting 
in a single large fc-survivable piece. 

Theorem 1 (Expansion of k-survivability): Let Ma be a 
mapping of a set of logical edges A c E L on the physical 
topology G*, such that the pair [G L ,Afyi] is piecewise 
fc-survivable. Let G c = G L [A. Take any subgraph of G c ', 
call it G^ b = (Xubi B )- Let m b be a mapping of the set B of 
edges of G^ b on G*. If the pair [G^.Mb] is fc-survivable 
then the pair [Origin(G s ^ , b ),M^UMs] is also fc-survivable. 




path 

Pu,v 



Fig. 3. Illustration of proof of Theorem[y A first portion of the path p^ v is 
the path p c c c found in G^ lb . Next it is completed, where necessary, with 
the patches found in origins of the nodes of %> c c . 

Proof: [Please refer to Fig. |3] 
First note that since G c = G L J. A, no logical edge from the 



set A can be found in G c , which implies that A n B = 0. 
Therefore the operation Ma U Mb is always well defined, as 
in (0 and (0. 

Let M AUB = M A UM B and G s ^ b = Origin(G s ^ b ). We have 
to prove that the pair [(^jjM^ub] is fc-survivable. Take 
any set E% C -E^ of k physical links and any two vertices 
u, v G Quj,. According to Definition Q we have to show that 
there exists a path p^ v in G^ b such that A4us(p«,t,)n^ = 0. 
The path p^ „ is constructed in two steps, (i) and (ii). 
(i) A first portion of p^ v is found in the contracted graph 
G c (recall that G c consists of logical edges), as follows. Call 
u c ,v c G V s £ b the vertices in G^ b = {V s ^ b ,B) whose origins 
contain u and v, respectively, i.e., such that u G Origin(u ) 
and u G Origin(v c ). Find a path p c c c in Q„ fe , such that 

Mb(p C c c) H -B* = 0. This is always possible since the 
pair [Q„j,,Mb] is fc-survivable. We take p^ c vC as the first 
portion of p^ v . 

(ii) We now turn our attention to the origins of vertices in 
the path p c c . Take any two consecutive edges a L and b L 
of p c c c, and let w c be their common end-node in G9, h . If 

" u^' ,v c sub 

Origin(w c ) is not a single node in G^ lb , then a L and fe L might 
not have a common end-node in G s ^ b . However, by piece wise 
fc-survivability of \G , Ma], the pair [0rj<7m(iu c '), M^] is 
fc-survivable. Therefore, if we denote respectively by v a ,v b G 
Origin(w c ) the end-nodes of a L and b L , that belong to 
Origin(w c ), we can find a logical path p^ a v in Origin(w ) 
connecting v a and uj,, such that Ma(Pv v . )^Ef = 0. We call 
this path a 'patch' of w c and denote it by patch(w c ). If for 
a given w c , the edges a L and 6 L have a common end-node 
w L in G^ b then patch(w c ) = u L . 

For every vertex w c G p^c c , find patch(w ). If w c =u c 
then patch(u c ) will connect the logical vertex u with an end- 
node of the first logical edge in p c c c , instead of connecting 
two end-nodes. The same holds for w c —v c . 
To summarize, in step (i) we have found the path p c c c 
in the contracted subgraph G^ b . Next, in step (ii), we have 
constructed a set of patches for each vertex of this path. Now 
we combine steps (i) and (ii) to obtain the full path p^ v '- 

Pu,v=PuO, v ou{ |J patchiw )}. (5) 

The logical path p\ t v connects the vertices u and v and has 
been constructed in such a way, that 

M B (pZo tV o)nE+ = Q (6) 

M A (patch(w c )) nEf = <D for every w c £p°o fV o ■ (7) 

Since Ma U Mb = Maob an d A n B = 0, we can rewrite 
© and Q as 

M A u B (pZc tV c)nE* = $ (8) 

M AU B {patch(w c ) ) n El = for every w c G p£ c jV o ■ (9) 

Combining (0, © and © yields finally that Maub(Pu,v) n 
.E^ = 0, which proves the claim. ■ 



The following example illustrates Theorem ^ 
Example 6: In Example [5] we have shown that in 
Fig. [^, the pair [G L ,Myi] is piecewise 1-survivable. 
Take G s c ub = G c = G L [ A and take M B as in Fig. GJ>. 
From Example 0] we know that the pair \G ' , Mg] 
is 1-survivable. Now, by Theorem ^ the pair 
[Origin(G c ), M A UM B ] = [G L ,M A UM B ] is 1-survivable. 
So starting from the piecewise 1-survivable mapping Ma and 
adding the mapping Mb, we merged the two 1-survivable 
pieces G L {aL bL cL} and Gj^ ^ , iL} into a single, large, 
1-survivable piece. In this example the resulting 1-survivable 
piece is the entire logical topology G L . The full mapping 
MaUMb = M e l is shown in Fig.^. 



B. Invariance of survivability under contraction 

Theorem 2 (Invariance of k-survivability under contraction): 
Let G s ^ b = (\£ub'B) be a subgraph of some contracted 
topology G c . If Mb is a mapping such that the pair 
[Q„6 , Mb] is /c-survivable, then for any set A G B of 
logical links the pair [Q^ 6 L4, Mb] is also fc-survivable. 




Origin(u ) 

Origin(w ) 

Origin(y ), Origin(v ) 




C Origin(u^ ) 
C Origin(w^) 
C Origin(v^ ) 



{c L } 



Fig. 4. Illustration of the proof of Theorem |2| (a) The original subgraph 
Gj^ b and a path v c c mat av °ids the set of physical links E^ in its 
mapping. (b) The subgraph G^ b contracted on the set A = {c L } of 
logical edges; the resulting subgraph is denoted by G .^A. The path "p c c 

originates from p c c c , hence it also avoids EJ, in its mapping. 

Proof: [Please refer to Fig. 
Take any set Et C E^ of k physical links and any two vertices 
u^,v^ G G^ b i A. According to Definition Q we have to 
show that there exists a path p c c c in G s ^ b J, A such that 

First, find in G^ b two vertices u c ,v c G ^ b , such that 

Origin{u c ) C Origin(u^), and (10) 

Origin(v ) C Origin(v^). (11) 

Note that since Q^ & |^4 is created by contracting some edges in 
C^ b , vertices u and v c always exist (they are not necessarily 
unique). Since the pair [G^ b , Mb] is fc-survivable, there exists 
a pathp^c in G^ ub such that M B (p°c iV c)nE$ = 0. Define 
a sequence of logical edges p 1 ^' by contracting in p c c c all 



edges that exist also in A, i.e., 



P* 



p c u c^ v c HAn p c CiV c). 



(12) 



Since p c 



is a path in G s ^ b , and since the contraction an 



edge merges its two end-nodes and thus preserves its conti- 
nuity, p^ is a path in G^ h [A. Moreover, the relations 11011 II 
imply that the path p% connects v% and v* in G^ b [A. Finally, 
M B (jf c >v o)nE* = and (O yields that M B (pf)nEf = 0. 
Therefore p^' is the path p c c c that we are searching for. ■ 

In other words, Theorem [2] says that if we can map in 
a fc-survivable way some subgraph G^ b of the logical or 
contracted logical topology, then the subgraph obtained by 
contracting some additional set A of edges can always be 
mapped in a fc-survivable way, whatever the choice of A. 

Example 7: Take G^ ub = G L and M b = M e l as in Fig.GJ. 
We know that the pair [G L , M e l\ is 1-survivable. Theorem[2] 
implies that for any set of logical edges A C E L the pair 
[G L jA, M e l\ is also 1-survivable. In particular, for the set 
A as defined in Fig.[^, [G L jA, M e l\ is 1-survivable, which 
was shown in Example |4] (M B C M e l). 

Note that we do not impose any requirements (such as 
e.g., preserving piecewise fc-survivability) on the contracted 
edges A. Moreover, we do not have any restrictions on what 
happens with the rest of the contracted topology, i.e., in 

G \ G S ub- 

C. The existence of a k-survivable mapping 

In general, for a given pair of physical and logical topolo- 
gies, it is very difficult to verify the existence of a fc-survivable 
mapping. A heuristic approach, if fails, does not give any 
answer. The ILP approach or an exhaustive search could 
provide us with the answer, but due to their high computational 
complexity their application is limited to the topologies of sev- 
eral nodes. The following theorem shows how this verification 
problem can be substantially reduced: 

Theorem 3 (Existence of a k-survivable mapping): Let 
Ma be a mapping of a set of logical edges A C E L , such that 
the pair \G L , Ma] is piecewise fc-survivable. A fc-survivable 
mapping MJ,"™ of G L on G* exists if and only if there 
exists a mapping M E Y\Z of the set of logical links E L \A on 
G*, such that the pair [G L j A, MJ^™ ] is fc-survivable. 

Proof: 
<= We know that the pair [G L , Mm is piecewise 
fc-survivable. Suppose that there exists a mapping M E Y\Z, 
such that the pair [G L {A,M™g£\ is fc-survivable. Then, 
by Theorem [1] the pair [Origin(G L i A) , M^UAf^] = 
[G L , M^UMS] is also fc-survivable. So the mapping 



M 



E L 

G't'. 



Ma U M e u l\ A is a fc-survivable mapping of G 



=>• Assume that a fc-survivable mapping of G L on G^ exists, 
call it M S E T V . Now, by taking G^ b :=G L and M B :=M S E T V , 
Theorem yields that [G L lA,M™f°] is fc-survivable. Con- 
sequently, the pair \G [ A, M E Y\\] is also fc-survivable. ■ 

The following example illustrates this theorem. 



Example 8: In Fig. [Q delete edge b^ from the physical 
topology G^. Now, for the logical topology G L and the physi- 
cal topology G^\{b^}, a 1-survivable mapping does not exist. 
To prove it, note that we can still easily find a mapping Ma 
of G L on G^\{6^} that is piecewise 1-survivable. However, 
the remaining two logical links d L and e L , cannot be mapped 
edge-disjointly on G*\{6^}. Therefore no 1-survivable map- 
ping MiAL^hx of the contracted logical topology G L {A on 
G^\{b^} exists. Consequently, by Theorem [3] we know that 
no 1-survivable mapping of G L on G^\{b^} exists, which 
was to be proved. Note that to prove it we only considered 
the two-edge topology G L {A instead of the entire G L , which 
greatly simplified the problem. Clearly, the larger the set A, 
the more we benefit from Theorem [3] 

IV. The fc-SMART algorithm 

In this section we present an algorithm that searches for a 
fc-survivable mapping. We call this algorithm fc-SMART, as 
it is a straightforward extension of the SMART algorithm [1], 
[2] to multiple failures. It maps the topology part by part, 
gradually converging to a final solution. By formal graph 
theoretic analysis, we prove that if fc-SMART converges com- 
pletely, a k-survivable mapping is found. Otherwise, when the 
algorithm terminates before its complete convergence, the re- 
turned mapping is piecewise k-survivable and no fc-survivable 
solution exists. 

A. The pseudo-code of k-SMART 

Step 1 Start from the full logical topology G c = G L , and 
an empty mapping Ma = 0, A = 0; 

Step 2 Take some subgraph G^ b = {V s ° b ,B) of G c and 
find a mapping M B , such that the pair [G^ lb , M B ~\ 
is fc-survivable. IF no such pair exists, THEN RE- 
TURN M A AND G c = G L [ A, END. 

Step 3 Update the mapping by merging Ma and M B , i.e., 
Ma :=MaUM b ; 

Step 4 Contract G c on B, i.e., G c := G C [B\ 

Step 5 IF G c is a single node, THEN RETURN M A , END. 

Step 6 GOTO Step 2 

The fc-SMART algorithm starts from an empty mapping 
Ma = 0- At each iteration it maps some set B of logical 
links (Step 2), and extends the mapping Ma by M B (Step 3). 
Meanwhile, the contracted topology G c gradually shrinks 
(Step 4). 

B. The correctness of the k-SMART algorithm 

We will declare that: 

• k-SMART converges if the contracted topology G 
converges to a single node. We prove later in Corollary \l\ that 
the mapping Ma returned in step 5 is then a fc-survivable 
solution; 

• k-SMART does not converge if fc-SMART terminates 
before G c converges to a single node. This happens when 
Step 2 of fc-SMART is impossible to make. We prove below 
in Theorem |4] that the mapping Ma returned in Step 2 
piecewise fc-survivable. Moreover, we show in CorollarylOthat 



in this case a fc-survivable solution does not exist. The graph 
G c — G L [A (also returned in Step 2) we call the remaining 
contracted logical topology since it consists of unmapped 
logical links E L \i. 

Theorem 4 (k-SMART's piecewise k-surviv ability): After 
each iteration of the fc-SMART algorithm, the pair [G L ,M A ] 
is piecewise fc-survivable. 
Proof: [By induction] 
INITIALIZATION: 

Initially G c = G L . Therefore the origin of any vertex v c £ 
V c is a single node in G L , and it cannot be disconnected. 
Hence for every v c £ V c , the pair \Origin(v ), Ma] is 
fc-survivable and consequently the pair [G L , Ma] is piecewise 
fc-survivable. 
INDUCTION: 

Assume that after some iteration the pair [G L , Mm is piece- 
wise fc-survivable. We have to prove that after the next 
iteration of the algorithm, the updated mapping Ma will still 
form a piecewise fc-survivable pair [G L , Mm ■ 
One iteration of the fc-SMART algorithm consists of Steps 2, 
3 and 4, which we recall here: 

2. Find G^ b = {V s ° b ,B) and M B , such that the pair 
[G^ b ,M B ] is fc-survivable. 

3. M A := M A U M B 

4. G c :=G C [B 

(For clarity we indicated the updated Ma and G c by a hat: 

The updated contracted topology G c = (V , E c ) was 
created from G c by replacing G^ b — {V s ^ b ,B) with a 
single node, which we call vj^ b ; the remaining nodes stayed 
unchanged. So V c = {y^ b } U V c \V s ^ b . Take any v c e V c ; 
we have two possibilities: 

(i) v c = ij£ b : Since G^ b = {V s ^ b ,B) was contracted into 

Origin^) 



, their origins coincide: Origin(G s ( ^ l 



J sub/ 



<iub 

Since M A = M A U M B , the pair [Origin(v£ lb ),M A ] = 
\Origin(Gj^ b ) , Ma U Mb] is fc-survivable by Theorem^ 
(ii) v* 7 ^ y£ b : In this case u c E V c \V s ^ b , so u c = v c . 
By piecewise fc-survivability of the pair [G L , Ma] , the pair 
[Origin(v c — v c ),A1a] is fc-survivable. Since Ma = 
Ma U Mb, the pair [Origin(v c ),MA] is fc-survivable as 
well. 

Combining (i) and (ii), we have proven that for every v c G 
V c , the pair [Origin(v c ),MA] is fc-survivable. So, by 
Definition |6] the pair \G L , Ma] is piecewise fc-survivable. 

■ 

Theorem @] leads us to the following important property of 
fc-SMART: 

Corollary 1 (k-SMART's convergence): The fc-SMART 
algorithm returns a single node contracted topology G if 
and only if there exists a fc-survivable mapping of the logical 
graph G L on the physical graph G*. In this case the returned 
mapping Ma is fc-survivable. 

Proof: 
=> We have to show that if there is only one vertex in G 



then \G L , Ma] is fc-survivable. 

We have two observations: (i) By Theorem |4] the pair 
\G L , Ma] is piecewise fc-survivable. This means that for 
every vertex v c 6 G c the pair [Origin(v c ) , Ma] is 
fc-survivable. (ii) There is only one vertex in G c (i.e., G c = 
{v c }), and therefore Origin(v c ) — G L . Combining (i) and 
(ii), we have that [G L , Ma] is fc-survivable. 

<^ We have to show that if the contracted topology G c has 
more than one node then a fc-survivable mapping of G L on 
G^ does not exist. 

By Theorem|4] the pair [G L ,Myi] is piecewise fc-survivable. 
Since the algorithm has returned before converging to a single 
node (i.e., in Step 2), there exists no pair [G^ b ,M B ] that is 
fc-survivable. In particular, if we take G s ^ b — G c — G L [A, 
there exists no pair \G L { A, MA that is fc-survivable. Now, 
by Theorem [5] there exists no fc-survivable mapping of G L on 
G+. M 

G c may converge to a single node topology with self-loops; 
they form a set of remaining unmapped logical links E L \A. 
However, this does not affect the result, because the links of 
E L \A may be mapped in any way (e.g. shortest path) to obtain 
a full fc-survivable mapping M e l. 

C. The order of a sequence of subgraphs 

Recall that in Step 2 of the fc-SMART algorithm we take 
some subgraph G^ b = (\^^ b ,B) of the contracted topology 
G c . We do not specify which subgraph to take; if there are 
more candidates G s ^ b that meet the condition given in Step 2 
(which is usually the case), we are free to pick any of them. 
This raises a natural question: How does the choice of G^ b 
affect the convergence of the fc-SMART algorithm? In the 
following theorem we show that, in general, this choice does 
not affect the outcome of the fc-SMART algorithm. 

Theorem 5 (k-SMART unique convergence): There exists 
a unique contracted topology G^ in (excluding self-loops) 
returned by fc-SMART. 

Proof: [By contradiction, Please refer to Fig. |5) 
Let us assume that two different runs of fc-SMART converge 
to two different contracted topologies Gf = G L [ A and 
Gj = G L [B, and the mappings Ma and M B , respectively. 
The fc-SMART algorithm returned in Step 2, which implies 
that no subgraph G s ^ bl of Gf can be mapped in a fc-survivable 
way; similarly, no subgraph G^ b2 of Gfp can be mapped in 
a fc-survivable way. Assume, without loss of generality, that 
there exists an edge ef such that e^ S Gfp and e^ ^ Gf . 
(If such an edge does not exist, an edge satisfying a converse 
condition must exist, because Gf 7^ G^\) Since e^ ^ Gf , 
there exists ujp 6 Gf such that e^ G Origin(v^). By 
Theorem |4] the pair [Gf,M^i] is piecewise fc-survivable, 
which implies that \Origin(v*), Ma] is fc-survivable. Now, 
by Theorem |2] the pair [Origin(vf) j B, Ma] is also 
fc-survivable. By construction the subgraph Origin(v^)[B 
contains at least the edge ef. Therefore, there exists a non- 
empty subgraph G^ b = Origin(v^)\,B of G% that can be 



Gf = G L [A 



G% = G L [B 




Fig. 5. Illustration of proof of Theorem |5] We start with an edge e^ 
that is in G§ , but not in Gf . Next, we choose a vertex t>~ £ Gf such 
that ef 6 Origin{v~;). In the topology G2 , Of*iflw(v» ) is contracted 
to OriginYt;, ) J. B that contains at least e*. This nonempty subgraph 
Origin(v~f) [B can be mapped in a fc-survivable way using the mapping 
Mj\, which leads to contradiction. 



mapped in a fc-survivable way (using the mapping Ma), which 
is impossible because no subgraph G^ b2 of G 2 can be mapped 
in a fc-survivable way. ■ 

A direct consequence of Theorem [5] is that the order in 
which we take G^ b in the fc-SMART algorithm does not affect 
the final result. 

V. Implementation and applications 

In practice, it is not feasible to implement the exact code 
given in IIV-AI because Step 2 alone is an NP-complete 
problem. A possible practical solution is to restrict the types 
of subgraphs G s ^ b taken in Step 2 of the fc-SMART algorithm. 
Clearly, in order to map a graph G^ b in a fc-survivable 
way, G^ b has to be a (fc+l)-edge-connected. For instance, 
to achieve a 2-survivability we can consider in Step 2 the 
3-edge-connected structures shown in Fig.|6] We have imple- 
mented this in [1] with very good results. 





Fig. 6. Possible subgraphs G . that can be considered in Step 2 in the 
implementation of the fc-SMART algorithm, for k = 2. 



• a tool tracing and repairing the vulnerable areas of the 
network, 

• a fast heuristic. 

VI. Conclusions 

In this paper we have extended all the theoretical results 
in [2] to the presence of multiple link failures. In the future 
we plan to apply these results to design a mapping robust 
to multiple failures in various scenarios in IP-over-WDM 
networks. 

The work presented in this paper was financially supported 
by grant DICS 1830 of the Hasler Foundation, Bern, Switzer- 
land. 
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Since we have, in this paper, extended all the theorems 
from [2] to multiple failure scenarios, all applications of 
SMART described in [2] naturally carry over to fc-SMART. 
In particular, we can apply the fc-SMART algorithm as: 

• the formal verification of the existence of a fc-survivable 
mapping, 



